Konfiguration auf Clientseite zur Client-Authentification via anonymous bind

Bei den betreffenden Clients wollen wir nun die Authentifizierung der einzelnen User nicht mehr gegen die lokale /etc/shadow laufen lassen, denn dazu müssten wir nun auf jedem Host die User manuell (nach)pflegen. Schließlich sollen die User, egal an welchem Host sie sich anmelden, immer auch das gleiche Passwort benutzen können. Nicht zuletzt aus diesem Gründen, haben wir uns für einen zentralen OpenLDAP-Server entschieden.

Die nachfolgende Beschreibung nutzt bei der Realisierung keinen System Security Services Daemon sssd. Auf diesen werden wir noch in einem separatem Kapitel detailliert eingehen.

Installation

Wie bereits erwähnt, verzichten wir im ersten Schritt auf den System Security Services Daemon. Als erstes deinstallieren wir den sssd, sofern dieser zuvor installiert worden war.

 # yum remove sssd

Auf der Clientseite benötigen wir nachfolgende Pakete, die wir bei Bedarf mit Unterstützung von YUM nachinstallieren.

openldap
openldap-clients
pam_ldap
nss-pam-ldapd
pam
glibc
authconfig

 # yum install openldap openldap-clients pam_ldap nss-pam-ldapd pam glibc authconfig -y

Was uns die einzelnen Pakete mit ins System bringen, erkunden wir bei Bedarf mit dem Aufruf mit dem Aufruf von rpm -qil.

openldap

 # rpm -qil openldap

Name        : openldap                     Relocations: (not relocatable)
Version     : 2.4.19                            Vendor: CentOS
Release     : 15.el6_0.2                    Build Date: Sat 25 Jun 2011 12:30:55 PM CEST
Install Date: Sun 16 Oct 2011 04:00:01 PM CEST      Build Host: c6b6.bsys.dev.centos.org
Group       : System Environment/Daemons    Source RPM: openldap-2.4.19-15.el6_0.2.src.rpm
Size        : 696888                           License: OpenLDAP
Signature   : RSA/8, Wed 06 Jul 2011 03:42:02 AM CEST, Key ID 0946fca2c105b9de
Packager    : CentOS BuildSystem <http://bugs.centos.org>
URL         : http://www.openldap.org/
Summary     : LDAP support libraries
Description :
OpenLDAP is an open source suite of LDAP (Lightweight Directory Access
Protocol) applications and development tools. LDAP is a set of
protocols for accessing directory services (usually phone book style
information, but other information is possible) over the Internet,
similar to the way DNS (Domain Name System) information is propagated
over the Internet. The openldap package contains configuration files,
libraries, and documentation for OpenLDAP.
/etc/openldap
/etc/openldap/cacerts
/etc/openldap/ldap.conf
/usr/lib64/liblber-2.4.so.2
/usr/lib64/liblber-2.4.so.2.5.2
/usr/lib64/libldap-2.4.so.2
/usr/lib64/libldap-2.4.so.2.5.2
/usr/lib64/libldap_r-2.4.so.2
/usr/lib64/libldap_r-2.4.so.2.5.2
/usr/share/doc/openldap-2.4.19
/usr/share/doc/openldap-2.4.19/ANNOUNCEMENT
/usr/share/doc/openldap-2.4.19/CHANGES
/usr/share/doc/openldap-2.4.19/COPYRIGHT
/usr/share/doc/openldap-2.4.19/LICENSE
/usr/share/doc/openldap-2.4.19/README
/usr/share/man/man5/ldap.conf.5.gz
/usr/share/man/man5/ldif.5.gz

openldap-clients

 # rpm -qil openldap-clients

Name        : openldap-clients             Relocations: (not relocatable)
Version     : 2.4.19                            Vendor: CentOS
Release     : 15.el6_0.2                    Build Date: Sat 25 Jun 2011 12:30:55 PM CEST
Install Date: Fri 28 Oct 2011 09:17:51 AM CEST      Build Host: c6b6.bsys.dev.centos.org
Group       : Applications/Internet         Source RPM: openldap-2.4.19-15.el6_0.2.src.rpm
Size        : 612692                           License: OpenLDAP
Signature   : RSA/8, Wed 06 Jul 2011 03:42:03 AM CEST, Key ID 0946fca2c105b9de
Packager    : CentOS BuildSystem <http://bugs.centos.org>
URL         : http://www.openldap.org/
Summary     : LDAP client utilities
Description :
OpenLDAP is an open-source suite of LDAP (Lightweight Directory Access
Protocol) applications and development tools. LDAP is a set of
protocols for accessing directory services (usually phone book style
information, but other information is possible) over the Internet,
similar to the way DNS (Domain Name System) information is propagated
over the Internet. The openldap-clients package contains the client
programs needed for accessing and modifying OpenLDAP directories.
/usr/bin/ldapadd
/usr/bin/ldapcompare
/usr/bin/ldapdelete
/usr/bin/ldapexop
/usr/bin/ldapmodify
/usr/bin/ldapmodrdn
/usr/bin/ldappasswd
/usr/bin/ldapsearch
/usr/bin/ldapurl
/usr/bin/ldapwhoami
/usr/share/man/man1/ldapadd.1.gz
/usr/share/man/man1/ldapcompare.1.gz
/usr/share/man/man1/ldapdelete.1.gz
/usr/share/man/man1/ldapexop.1.gz
/usr/share/man/man1/ldapmodify.1.gz
/usr/share/man/man1/ldapmodrdn.1.gz
/usr/share/man/man1/ldappasswd.1.gz
/usr/share/man/man1/ldapsearch.1.gz
/usr/share/man/man1/ldapurl.1.gz
/usr/share/man/man1/ldapwhoami.1.gz

pam_ldap

 # rpm -qil pam_ldap

Name        : pam_ldap                     Relocations: (not relocatable)
Version     : 185                               Vendor: CentOS
Release     : 5.el6                         Build Date: Mon 23 Aug 2010 08:00:38 AM CEST
Install Date: Sun 16 Oct 2011 02:57:36 PM CEST      Build Host: c6b2.bsys.dev.centos.org
Group       : System Environment/Base       Source RPM: pam_ldap-185-5.el6.src.rpm
Size        : 158003                           License: LGPLv2+
Signature   : RSA/8, Sun 03 Jul 2011 06:53:46 AM CEST, Key ID 0946fca2c105b9de
Packager    : CentOS BuildSystem <http://bugs.centos.org>
URL         : http://www.padl.com/OSS/pam_ldap.html
Summary     : PAM module for LDAP
Description :
pam_ldap is a module for Linux-PAM that supports password changes, server-
enforced password policies, access authorization, and crypted hashes.
/etc/pam_ldap.conf
/etc/pam_ldap.secret
/lib64/security/pam_ldap.so
/usr/share/doc/pam_ldap-185
/usr/share/doc/pam_ldap-185/AUTHORS
/usr/share/doc/pam_ldap-185/COPYING
/usr/share/doc/pam_ldap-185/COPYING.LIB
/usr/share/doc/pam_ldap-185/ChangeLog
/usr/share/doc/pam_ldap-185/NEWS
/usr/share/doc/pam_ldap-185/README
/usr/share/doc/pam_ldap-185/README.TLS
/usr/share/doc/pam_ldap-185/ldapns.schema
/usr/share/doc/pam_ldap-185/ns-pwd-policy.schema
/usr/share/doc/pam_ldap-185/pam.d
/usr/share/doc/pam_ldap-185/pam.d/chfn
/usr/share/doc/pam_ldap-185/pam.d/chsh
/usr/share/doc/pam_ldap-185/pam.d/ftp
/usr/share/doc/pam_ldap-185/pam.d/gdm
/usr/share/doc/pam_ldap-185/pam.d/halt
/usr/share/doc/pam_ldap-185/pam.d/imap
/usr/share/doc/pam_ldap-185/pam.d/kde
/usr/share/doc/pam_ldap-185/pam.d/linuxconf
/usr/share/doc/pam_ldap-185/pam.d/linuxconf-pair
/usr/share/doc/pam_ldap-185/pam.d/login
/usr/share/doc/pam_ldap-185/pam.d/mcserv
/usr/share/doc/pam_ldap-185/pam.d/other
/usr/share/doc/pam_ldap-185/pam.d/passwd
/usr/share/doc/pam_ldap-185/pam.d/pop
/usr/share/doc/pam_ldap-185/pam.d/poweroff
/usr/share/doc/pam_ldap-185/pam.d/ppp
/usr/share/doc/pam_ldap-185/pam.d/reboot
/usr/share/doc/pam_ldap-185/pam.d/rexec
/usr/share/doc/pam_ldap-185/pam.d/rlogin
/usr/share/doc/pam_ldap-185/pam.d/rsh
/usr/share/doc/pam_ldap-185/pam.d/samba
/usr/share/doc/pam_ldap-185/pam.d/shutdown
/usr/share/doc/pam_ldap-185/pam.d/ssh
/usr/share/doc/pam_ldap-185/pam.d/su
/usr/share/doc/pam_ldap-185/pam.d/vlock
/usr/share/doc/pam_ldap-185/pam.d/xdm
/usr/share/doc/pam_ldap-185/pam.d/xlock
/usr/share/doc/pam_ldap-185/pam.d/xscreensaver
/usr/share/doc/pam_ldap-185/pam.d/xserver
/usr/share/man/man5/pam_ldap.5.gz

nss-pam-ldapd

 # rpm -qil nss-pam-ldapd

Name        : nss-pam-ldapd                Relocations: (not relocatable)
Version     : 0.7.5                             Vendor: CentOS
Release     : 3.el6                         Build Date: Wed 25 Aug 2010 06:51:48 PM CEST
Install Date: Sun 16 Oct 2011 03:03:28 PM CEST      Build Host: c6b3.bsys.dev.centos.org
Group       : System Environment/Base       Source RPM: nss-pam-ldapd-0.7.5-3.el6.src.rpm
Size        : 464737                           License: LGPLv2+
Signature   : RSA/8, Sun 03 Jul 2011 06:47:54 AM CEST, Key ID 0946fca2c105b9de
Packager    : CentOS BuildSystem <http://bugs.centos.org>
URL         : http://arthurdejong.org/nss-pam-ldapd/
Summary     : An nsswitch module which uses directory servers
Description :
The nss-pam-ldapd daemon, nslcd, uses a directory server to look up name
service information (users, groups, etc.) on behalf of a lightweight
nsswitch module.
/etc/nslcd.conf
/etc/rc.d/init.d/nslcd
/lib64/libnss_ldap.so.2
/usr/lib64/libnss_ldap.so
/usr/sbin/nslcd
/usr/share/doc/nss-pam-ldapd-0.7.5
/usr/share/doc/nss-pam-ldapd-0.7.5/AUTHORS
/usr/share/doc/nss-pam-ldapd-0.7.5/COPYING
/usr/share/doc/nss-pam-ldapd-0.7.5/ChangeLog
/usr/share/doc/nss-pam-ldapd-0.7.5/HACKING
/usr/share/doc/nss-pam-ldapd-0.7.5/NEWS
/usr/share/doc/nss-pam-ldapd-0.7.5/README
/usr/share/doc/nss-pam-ldapd-0.7.5/TODO
/usr/share/man/man5/nslcd.conf.5.gz
/usr/share/man/man8/nslcd.8.gz
/var/run/nslcd

pam

 # rpm -qil pam

Name        : pam                          Relocations: (not relocatable)
Version     : 1.1.1                             Vendor: CentOS
Release     : 4.el6_0.1                     Build Date: Sat 25 Jun 2011 05:32:51 AM CEST
Install Date: Sun 16 Oct 2011 04:02:20 PM CEST      Build Host: c6b5.bsys.dev.centos.org
Group       : System Environment/Base       Source RPM: pam-1.1.1-4.el6_0.1.src.rpm
Size        : 2241000                          License: BSD and GPLv2+
Signature   : RSA/8, Wed 06 Jul 2011 03:44:29 AM CEST, Key ID 0946fca2c105b9de
Packager    : CentOS BuildSystem <http://bugs.centos.org>
URL         : http://www.us.kernel.org/pub/linux/libs/pam/index.html
Summary     : An extensible library which provides authentication for applications
Description :
PAM (Pluggable Authentication Modules) is a system security tool that
allows system administrators to set authentication policy without
having to recompile programs that handle authentication.
/etc/pam.d
/etc/pam.d/config-util
/etc/pam.d/fingerprint-auth
/etc/pam.d/other
/etc/pam.d/password-auth
/etc/pam.d/smartcard-auth
/etc/pam.d/system-auth
/etc/security
/etc/security/access.conf
/etc/security/chroot.conf
/etc/security/console.apps
/etc/security/console.handlers
/etc/security/console.perms
/etc/security/console.perms.d
/etc/security/group.conf
/etc/security/limits.conf
/etc/security/limits.d
/etc/security/limits.d/90-nproc.conf
/etc/security/namespace.conf
/etc/security/namespace.d
/etc/security/namespace.init
/etc/security/opasswd
/etc/security/pam_env.conf
/etc/security/sepermit.conf
/etc/security/time.conf
/lib/security
/lib64/libpam.so.0
/lib64/libpam.so.0.82.2
/lib64/libpam_misc.so.0
/lib64/libpam_misc.so.0.82.0
/lib64/libpamc.so.0
/lib64/libpamc.so.0.82.1
/lib64/security
/lib64/security/pam_access.so
/lib64/security/pam_chroot.so
/lib64/security/pam_console.so
/lib64/security/pam_cracklib.so
/lib64/security/pam_debug.so
/lib64/security/pam_deny.so
/lib64/security/pam_echo.so
/lib64/security/pam_env.so
/lib64/security/pam_exec.so
/lib64/security/pam_faildelay.so
/lib64/security/pam_filter
/lib64/security/pam_filter.so
/lib64/security/pam_filter/upperLOWER
/lib64/security/pam_ftp.so
/lib64/security/pam_group.so
/lib64/security/pam_issue.so
/lib64/security/pam_keyinit.so
/lib64/security/pam_lastlog.so
/lib64/security/pam_limits.so
/lib64/security/pam_listfile.so
/lib64/security/pam_localuser.so
/lib64/security/pam_loginuid.so
/lib64/security/pam_mail.so
/lib64/security/pam_mkhomedir.so
/lib64/security/pam_motd.so
/lib64/security/pam_namespace.so
/lib64/security/pam_nologin.so
/lib64/security/pam_permit.so
/lib64/security/pam_postgresok.so
/lib64/security/pam_pwhistory.so
/lib64/security/pam_rhosts.so
/lib64/security/pam_rootok.so
/lib64/security/pam_securetty.so
/lib64/security/pam_selinux.so
/lib64/security/pam_selinux_permit.so
/lib64/security/pam_sepermit.so
/lib64/security/pam_shells.so
/lib64/security/pam_stress.so
/lib64/security/pam_succeed_if.so
/lib64/security/pam_tally2.so
/lib64/security/pam_time.so
/lib64/security/pam_timestamp.so
/lib64/security/pam_tty_audit.so
/lib64/security/pam_umask.so
/lib64/security/pam_unix.so
/lib64/security/pam_unix_acct.so
/lib64/security/pam_unix_auth.so
/lib64/security/pam_unix_passwd.so
/lib64/security/pam_unix_session.so
/lib64/security/pam_userdb.so
/lib64/security/pam_warn.so
/lib64/security/pam_wheel.so
/lib64/security/pam_xauth.so
/sbin/mkhomedir_helper
/sbin/pam_console_apply
/sbin/pam_tally2
/sbin/pam_timestamp_check
/sbin/unix_chkpwd
/sbin/unix_update
/usr/share/doc/pam-1.1.1
/usr/share/doc/pam-1.1.1/Copyright
/usr/share/doc/pam-1.1.1/Linux-PAM_SAG.txt
/usr/share/doc/pam-1.1.1/html
/usr/share/doc/pam-1.1.1/html/Linux-PAM_SAG.html
/usr/share/doc/pam-1.1.1/html/sag-author.html
/usr/share/doc/pam-1.1.1/html/sag-configuration-directory.html
/usr/share/doc/pam-1.1.1/html/sag-configuration-example.html
/usr/share/doc/pam-1.1.1/html/sag-configuration-file.html
/usr/share/doc/pam-1.1.1/html/sag-configuration.html
/usr/share/doc/pam-1.1.1/html/sag-copyright.html
/usr/share/doc/pam-1.1.1/html/sag-introduction.html
/usr/share/doc/pam-1.1.1/html/sag-module-reference.html
/usr/share/doc/pam-1.1.1/html/sag-overview.html
/usr/share/doc/pam-1.1.1/html/sag-pam_access.html
/usr/share/doc/pam-1.1.1/html/sag-pam_cracklib.html
/usr/share/doc/pam-1.1.1/html/sag-pam_debug.html
/usr/share/doc/pam-1.1.1/html/sag-pam_deny.html
/usr/share/doc/pam-1.1.1/html/sag-pam_echo.html
/usr/share/doc/pam-1.1.1/html/sag-pam_env.html
/usr/share/doc/pam-1.1.1/html/sag-pam_exec.html
/usr/share/doc/pam-1.1.1/html/sag-pam_faildelay.html
/usr/share/doc/pam-1.1.1/html/sag-pam_filter.html
/usr/share/doc/pam-1.1.1/html/sag-pam_ftp.html
/usr/share/doc/pam-1.1.1/html/sag-pam_group.html
/usr/share/doc/pam-1.1.1/html/sag-pam_issue.html
/usr/share/doc/pam-1.1.1/html/sag-pam_keyinit.html
/usr/share/doc/pam-1.1.1/html/sag-pam_lastlog.html
/usr/share/doc/pam-1.1.1/html/sag-pam_limits.html
/usr/share/doc/pam-1.1.1/html/sag-pam_listfile.html
/usr/share/doc/pam-1.1.1/html/sag-pam_localuser.html
/usr/share/doc/pam-1.1.1/html/sag-pam_loginuid.html
/usr/share/doc/pam-1.1.1/html/sag-pam_mail.html
/usr/share/doc/pam-1.1.1/html/sag-pam_mkhomedir.html
/usr/share/doc/pam-1.1.1/html/sag-pam_motd.html
/usr/share/doc/pam-1.1.1/html/sag-pam_namespace.html
/usr/share/doc/pam-1.1.1/html/sag-pam_nologin.html
/usr/share/doc/pam-1.1.1/html/sag-pam_permit.html
/usr/share/doc/pam-1.1.1/html/sag-pam_pwhistory.html
/usr/share/doc/pam-1.1.1/html/sag-pam_rhosts.html
/usr/share/doc/pam-1.1.1/html/sag-pam_rootok.html
/usr/share/doc/pam-1.1.1/html/sag-pam_securetty.html
/usr/share/doc/pam-1.1.1/html/sag-pam_selinux.html
/usr/share/doc/pam-1.1.1/html/sag-pam_shells.html
/usr/share/doc/pam-1.1.1/html/sag-pam_succeed_if.html
/usr/share/doc/pam-1.1.1/html/sag-pam_tally.html
/usr/share/doc/pam-1.1.1/html/sag-pam_tally2.html
/usr/share/doc/pam-1.1.1/html/sag-pam_time.html
/usr/share/doc/pam-1.1.1/html/sag-pam_timestamp.html
/usr/share/doc/pam-1.1.1/html/sag-pam_umask.html
/usr/share/doc/pam-1.1.1/html/sag-pam_unix.html
/usr/share/doc/pam-1.1.1/html/sag-pam_userdb.html
/usr/share/doc/pam-1.1.1/html/sag-pam_warn.html
/usr/share/doc/pam-1.1.1/html/sag-pam_wheel.html
/usr/share/doc/pam-1.1.1/html/sag-pam_xauth.html
/usr/share/doc/pam-1.1.1/html/sag-security-issues-other.html
/usr/share/doc/pam-1.1.1/html/sag-security-issues-wrong.html
/usr/share/doc/pam-1.1.1/html/sag-security-issues.html
/usr/share/doc/pam-1.1.1/html/sag-see-also.html
/usr/share/doc/pam-1.1.1/html/sag-text-conventions.html
/usr/share/doc/pam-1.1.1/rfc86.0.txt
/usr/share/doc/pam-1.1.1/txts
/usr/share/doc/pam-1.1.1/txts/README.pam_access
/usr/share/doc/pam-1.1.1/txts/README.pam_chroot
/usr/share/doc/pam-1.1.1/txts/README.pam_console
/usr/share/doc/pam-1.1.1/txts/README.pam_cracklib
/usr/share/doc/pam-1.1.1/txts/README.pam_debug
/usr/share/doc/pam-1.1.1/txts/README.pam_deny
/usr/share/doc/pam-1.1.1/txts/README.pam_echo
/usr/share/doc/pam-1.1.1/txts/README.pam_env
/usr/share/doc/pam-1.1.1/txts/README.pam_exec
/usr/share/doc/pam-1.1.1/txts/README.pam_faildelay
/usr/share/doc/pam-1.1.1/txts/README.pam_filter
/usr/share/doc/pam-1.1.1/txts/README.pam_ftp
/usr/share/doc/pam-1.1.1/txts/README.pam_group
/usr/share/doc/pam-1.1.1/txts/README.pam_issue
/usr/share/doc/pam-1.1.1/txts/README.pam_keyinit
/usr/share/doc/pam-1.1.1/txts/README.pam_lastlog
/usr/share/doc/pam-1.1.1/txts/README.pam_limits
/usr/share/doc/pam-1.1.1/txts/README.pam_listfile
/usr/share/doc/pam-1.1.1/txts/README.pam_localuser
/usr/share/doc/pam-1.1.1/txts/README.pam_loginuid
/usr/share/doc/pam-1.1.1/txts/README.pam_mail
/usr/share/doc/pam-1.1.1/txts/README.pam_mkhomedir
/usr/share/doc/pam-1.1.1/txts/README.pam_motd
/usr/share/doc/pam-1.1.1/txts/README.pam_namespace
/usr/share/doc/pam-1.1.1/txts/README.pam_nologin
/usr/share/doc/pam-1.1.1/txts/README.pam_permit
/usr/share/doc/pam-1.1.1/txts/README.pam_postgresok
/usr/share/doc/pam-1.1.1/txts/README.pam_pwhistory
/usr/share/doc/pam-1.1.1/txts/README.pam_rhosts
/usr/share/doc/pam-1.1.1/txts/README.pam_rootok
/usr/share/doc/pam-1.1.1/txts/README.pam_securetty
/usr/share/doc/pam-1.1.1/txts/README.pam_selinux
/usr/share/doc/pam-1.1.1/txts/README.pam_sepermit
/usr/share/doc/pam-1.1.1/txts/README.pam_shells
/usr/share/doc/pam-1.1.1/txts/README.pam_stress
/usr/share/doc/pam-1.1.1/txts/README.pam_succeed_if
/usr/share/doc/pam-1.1.1/txts/README.pam_tally
/usr/share/doc/pam-1.1.1/txts/README.pam_tally2
/usr/share/doc/pam-1.1.1/txts/README.pam_time
/usr/share/doc/pam-1.1.1/txts/README.pam_timestamp
/usr/share/doc/pam-1.1.1/txts/README.pam_tty_audit
/usr/share/doc/pam-1.1.1/txts/README.pam_umask
/usr/share/doc/pam-1.1.1/txts/README.pam_unix
/usr/share/doc/pam-1.1.1/txts/README.pam_userdb
/usr/share/doc/pam-1.1.1/txts/README.pam_warn
/usr/share/doc/pam-1.1.1/txts/README.pam_wheel
/usr/share/doc/pam-1.1.1/txts/README.pam_xauth
/usr/share/locale/ar/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/as/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/bn_IN/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/ca/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/cs/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/da/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/de/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/es/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/fi/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/fr/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/gu/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/hi/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/hu/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/it/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/ja/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/kk/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/km/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/kn/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/ko/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/ml/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/mr/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/ms/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/nb/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/nl/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/or/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/pa/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/pl/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/pt/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/pt_BR/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/ru/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/si/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/sk/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/sr/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/sr@latin/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/sv/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/ta/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/te/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/tr/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/uk/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/zh_CN/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/zh_TW/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/zu/LC_MESSAGES/Linux-PAM.mo
/usr/share/man/man5/access.conf.5.gz
/usr/share/man/man5/config-util.5.gz
/usr/share/man/man5/console.apps.5.gz
/usr/share/man/man5/console.handlers.5.gz
/usr/share/man/man5/console.perms.5.gz
/usr/share/man/man5/group.conf.5.gz
/usr/share/man/man5/limits.conf.5.gz
/usr/share/man/man5/namespace.conf.5.gz
/usr/share/man/man5/pam.conf.5.gz
/usr/share/man/man5/pam.d.5.gz
/usr/share/man/man5/pam_env.conf.5.gz
/usr/share/man/man5/sepermit.conf.5.gz
/usr/share/man/man5/system-auth.5.gz
/usr/share/man/man5/time.conf.5.gz
/usr/share/man/man8/PAM.8.gz
/usr/share/man/man8/mkhomedir_helper.8.gz
/usr/share/man/man8/pam.8.gz
/usr/share/man/man8/pam_access.8.gz
/usr/share/man/man8/pam_console.8.gz
/usr/share/man/man8/pam_console_apply.8.gz
/usr/share/man/man8/pam_cracklib.8.gz
/usr/share/man/man8/pam_debug.8.gz
/usr/share/man/man8/pam_deny.8.gz
/usr/share/man/man8/pam_echo.8.gz
/usr/share/man/man8/pam_env.8.gz
/usr/share/man/man8/pam_exec.8.gz
/usr/share/man/man8/pam_faildelay.8.gz
/usr/share/man/man8/pam_filter.8.gz
/usr/share/man/man8/pam_ftp.8.gz
/usr/share/man/man8/pam_group.8.gz
/usr/share/man/man8/pam_issue.8.gz
/usr/share/man/man8/pam_keyinit.8.gz
/usr/share/man/man8/pam_lastlog.8.gz
/usr/share/man/man8/pam_limits.8.gz
/usr/share/man/man8/pam_listfile.8.gz
/usr/share/man/man8/pam_localuser.8.gz
/usr/share/man/man8/pam_loginuid.8.gz
/usr/share/man/man8/pam_mail.8.gz
/usr/share/man/man8/pam_mkhomedir.8.gz
/usr/share/man/man8/pam_motd.8.gz
/usr/share/man/man8/pam_namespace.8.gz
/usr/share/man/man8/pam_nologin.8.gz
/usr/share/man/man8/pam_permit.8.gz
/usr/share/man/man8/pam_postgresok.8.gz
/usr/share/man/man8/pam_pwhistory.8.gz
/usr/share/man/man8/pam_rhosts.8.gz
/usr/share/man/man8/pam_rootok.8.gz
/usr/share/man/man8/pam_securetty.8.gz
/usr/share/man/man8/pam_selinux.8.gz
/usr/share/man/man8/pam_sepermit.8.gz
/usr/share/man/man8/pam_shells.8.gz
/usr/share/man/man8/pam_succeed_if.8.gz
/usr/share/man/man8/pam_tally2.8.gz
/usr/share/man/man8/pam_time.8.gz
/usr/share/man/man8/pam_timestamp.8.gz
/usr/share/man/man8/pam_timestamp_check.8.gz
/usr/share/man/man8/pam_tty_audit.8.gz
/usr/share/man/man8/pam_umask.8.gz
/usr/share/man/man8/pam_unix.8.gz
/usr/share/man/man8/pam_userdb.8.gz
/usr/share/man/man8/pam_warn.8.gz
/usr/share/man/man8/pam_wheel.8.gz
/usr/share/man/man8/pam_xauth.8.gz
/usr/share/man/man8/unix_chkpwd.8.gz
/usr/share/man/man8/unix_update.8.gz
/var/log/tallylog
/var/run/console
/var/run/sepermit

glibc

 # rpm -qil glibc

Name        : glibc                        Relocations: (not relocatable)
Version     : 2.12                              Vendor: CentOS
Release     : 1.7.el6_0.5                   Build Date: Sat 25 Jun 2011 02:40:43 PM CEST
Install Date: Sun 16 Oct 2011 03:59:30 PM CEST      Build Host: c6b6.bsys.dev.centos.org
Group       : System Environment/Libraries   Source RPM: glibc-2.12-1.7.el6_0.5.src.rpm
Size        : 12619595                         License: LGPLv2+ and LGPLv2+ with exceptions and GPLv2+
Signature   : RSA/8, Wed 06 Jul 2011 03:38:32 AM CEST, Key ID 0946fca2c105b9de
Packager    : CentOS BuildSystem <http://bugs.centos.org>
URL         : http://sources.redhat.com/glibc/
Summary     : The GNU libc libraries
Description :
The glibc package contains standard libraries which are used by
multiple programs on the system. In order to save disk space and
memory, as well as to make upgrading easier, common system code is
kept in one place and shared between programs. This particular package
contains the most important sets of shared libraries: the standard C
library and the standard math library. Without these two libraries, a
Linux system will not function.
/etc/gai.conf
/etc/ld.so.cache
/etc/ld.so.conf
/etc/ld.so.conf.d
/etc/localtime
/etc/nsswitch.conf
/etc/rpc
/lib64/ld-2.12.so
/lib64/ld-linux-x86-64.so.2
/lib64/libBrokenLocale-2.12.so
/lib64/libBrokenLocale.so.1
/lib64/libSegFault.so
/lib64/libanl-2.12.so
/lib64/libanl.so.1
/lib64/libc-2.12.so
/lib64/libc.so.6
/lib64/libcidn-2.12.so
/lib64/libcidn.so.1
/lib64/libcrypt-2.12.so
/lib64/libcrypt.so.1
/lib64/libdl-2.12.so
/lib64/libdl.so.2
/lib64/libm-2.12.so
/lib64/libm.so.6
/lib64/libnsl-2.12.so
/lib64/libnsl.so.1
/lib64/libnss_compat-2.12.so
/lib64/libnss_compat.so.2
/lib64/libnss_dns-2.12.so
/lib64/libnss_dns.so.2
/lib64/libnss_files-2.12.so
/lib64/libnss_files.so.2
/lib64/libnss_hesiod-2.12.so
/lib64/libnss_hesiod.so.2
/lib64/libnss_nis-2.12.so
/lib64/libnss_nis.so.2
/lib64/libnss_nisplus-2.12.so
/lib64/libnss_nisplus.so.2
/lib64/libpthread-2.12.so
/lib64/libpthread.so.0
/lib64/libresolv-2.12.so
/lib64/libresolv.so.2
/lib64/librt-2.12.so
/lib64/librt.so.1
/lib64/libthread_db-1.0.so
/lib64/libthread_db.so.1
/lib64/libutil-2.12.so
/lib64/libutil.so.1
/lib64/rtkaio
/lib64/rtkaio/librt.so.1
/lib64/rtkaio/librtkaio-2.12.so
/sbin/ldconfig
/sbin/sln
/usr/lib64/gconv
/usr/lib64/gconv/ANSI_X3.110.so
/usr/lib64/gconv/ARMSCII-8.so
/usr/lib64/gconv/ASMO_449.so
/usr/lib64/gconv/BIG5.so
/usr/lib64/gconv/BIG5HKSCS.so
/usr/lib64/gconv/BRF.so
/usr/lib64/gconv/CP10007.so
/usr/lib64/gconv/CP1125.so
/usr/lib64/gconv/CP1250.so
/usr/lib64/gconv/CP1251.so
/usr/lib64/gconv/CP1252.so
/usr/lib64/gconv/CP1253.so
/usr/lib64/gconv/CP1254.so
/usr/lib64/gconv/CP1255.so
/usr/lib64/gconv/CP1256.so
/usr/lib64/gconv/CP1257.so
/usr/lib64/gconv/CP1258.so
/usr/lib64/gconv/CP737.so
/usr/lib64/gconv/CP775.so
/usr/lib64/gconv/CP932.so
/usr/lib64/gconv/CSN_369103.so
/usr/lib64/gconv/CWI.so
/usr/lib64/gconv/DEC-MCS.so
/usr/lib64/gconv/EBCDIC-AT-DE-A.so
/usr/lib64/gconv/EBCDIC-AT-DE.so
/usr/lib64/gconv/EBCDIC-CA-FR.so
/usr/lib64/gconv/EBCDIC-DK-NO-A.so
/usr/lib64/gconv/EBCDIC-DK-NO.so
/usr/lib64/gconv/EBCDIC-ES-A.so
/usr/lib64/gconv/EBCDIC-ES-S.so
/usr/lib64/gconv/EBCDIC-ES.so
/usr/lib64/gconv/EBCDIC-FI-SE-A.so
/usr/lib64/gconv/EBCDIC-FI-SE.so
/usr/lib64/gconv/EBCDIC-FR.so
/usr/lib64/gconv/EBCDIC-IS-FRISS.so
/usr/lib64/gconv/EBCDIC-IT.so
/usr/lib64/gconv/EBCDIC-PT.so
/usr/lib64/gconv/EBCDIC-UK.so
/usr/lib64/gconv/EBCDIC-US.so
/usr/lib64/gconv/ECMA-CYRILLIC.so
/usr/lib64/gconv/EUC-CN.so
/usr/lib64/gconv/EUC-JISX0213.so
/usr/lib64/gconv/EUC-JP-MS.so
/usr/lib64/gconv/EUC-JP.so
/usr/lib64/gconv/EUC-KR.so
/usr/lib64/gconv/EUC-TW.so
/usr/lib64/gconv/GB18030.so
/usr/lib64/gconv/GBBIG5.so
/usr/lib64/gconv/GBGBK.so
/usr/lib64/gconv/GBK.so
/usr/lib64/gconv/GEORGIAN-ACADEMY.so
/usr/lib64/gconv/GEORGIAN-PS.so
/usr/lib64/gconv/GOST_19768-74.so
/usr/lib64/gconv/GREEK-CCITT.so
/usr/lib64/gconv/GREEK7-OLD.so
/usr/lib64/gconv/GREEK7.so
/usr/lib64/gconv/HP-GREEK8.so
/usr/lib64/gconv/HP-ROMAN8.so
/usr/lib64/gconv/HP-ROMAN9.so
/usr/lib64/gconv/HP-THAI8.so
/usr/lib64/gconv/HP-TURKISH8.so
/usr/lib64/gconv/IBM037.so
/usr/lib64/gconv/IBM038.so
/usr/lib64/gconv/IBM1004.so
/usr/lib64/gconv/IBM1008.so
/usr/lib64/gconv/IBM1008_420.so
/usr/lib64/gconv/IBM1025.so
/usr/lib64/gconv/IBM1026.so
/usr/lib64/gconv/IBM1046.so
/usr/lib64/gconv/IBM1047.so
/usr/lib64/gconv/IBM1097.so
/usr/lib64/gconv/IBM1112.so
/usr/lib64/gconv/IBM1122.so
/usr/lib64/gconv/IBM1123.so
/usr/lib64/gconv/IBM1124.so
/usr/lib64/gconv/IBM1129.so
/usr/lib64/gconv/IBM1130.so
/usr/lib64/gconv/IBM1132.so
/usr/lib64/gconv/IBM1133.so
/usr/lib64/gconv/IBM1137.so
/usr/lib64/gconv/IBM1140.so
/usr/lib64/gconv/IBM1141.so
/usr/lib64/gconv/IBM1142.so
/usr/lib64/gconv/IBM1143.so
/usr/lib64/gconv/IBM1144.so
/usr/lib64/gconv/IBM1145.so
/usr/lib64/gconv/IBM1146.so
/usr/lib64/gconv/IBM1147.so
/usr/lib64/gconv/IBM1148.so
/usr/lib64/gconv/IBM1149.so
/usr/lib64/gconv/IBM1153.so
/usr/lib64/gconv/IBM1154.so
/usr/lib64/gconv/IBM1155.so
/usr/lib64/gconv/IBM1156.so
/usr/lib64/gconv/IBM1157.so
/usr/lib64/gconv/IBM1158.so
/usr/lib64/gconv/IBM1160.so
/usr/lib64/gconv/IBM1161.so
/usr/lib64/gconv/IBM1162.so
/usr/lib64/gconv/IBM1163.so
/usr/lib64/gconv/IBM1164.so
/usr/lib64/gconv/IBM1166.so
/usr/lib64/gconv/IBM1167.so
/usr/lib64/gconv/IBM12712.so
/usr/lib64/gconv/IBM1364.so
/usr/lib64/gconv/IBM1371.so
/usr/lib64/gconv/IBM1388.so
/usr/lib64/gconv/IBM1390.so
/usr/lib64/gconv/IBM1399.so
/usr/lib64/gconv/IBM16804.so
/usr/lib64/gconv/IBM256.so
/usr/lib64/gconv/IBM273.so
/usr/lib64/gconv/IBM274.so
/usr/lib64/gconv/IBM275.so
/usr/lib64/gconv/IBM277.so
/usr/lib64/gconv/IBM278.so
/usr/lib64/gconv/IBM280.so
/usr/lib64/gconv/IBM281.so
/usr/lib64/gconv/IBM284.so
/usr/lib64/gconv/IBM285.so
/usr/lib64/gconv/IBM290.so
/usr/lib64/gconv/IBM297.so
/usr/lib64/gconv/IBM420.so
/usr/lib64/gconv/IBM423.so
/usr/lib64/gconv/IBM424.so
/usr/lib64/gconv/IBM437.so
/usr/lib64/gconv/IBM4517.so
/usr/lib64/gconv/IBM4899.so
/usr/lib64/gconv/IBM4909.so
/usr/lib64/gconv/IBM4971.so
/usr/lib64/gconv/IBM500.so
/usr/lib64/gconv/IBM5347.so
/usr/lib64/gconv/IBM803.so
/usr/lib64/gconv/IBM850.so
/usr/lib64/gconv/IBM851.so
/usr/lib64/gconv/IBM852.so
/usr/lib64/gconv/IBM855.so
/usr/lib64/gconv/IBM856.so
/usr/lib64/gconv/IBM857.so
/usr/lib64/gconv/IBM860.so
/usr/lib64/gconv/IBM861.so
/usr/lib64/gconv/IBM862.so
/usr/lib64/gconv/IBM863.so
/usr/lib64/gconv/IBM864.so
/usr/lib64/gconv/IBM865.so
/usr/lib64/gconv/IBM866.so
/usr/lib64/gconv/IBM866NAV.so
/usr/lib64/gconv/IBM868.so
/usr/lib64/gconv/IBM869.so
/usr/lib64/gconv/IBM870.so
/usr/lib64/gconv/IBM871.so
/usr/lib64/gconv/IBM874.so
/usr/lib64/gconv/IBM875.so
/usr/lib64/gconv/IBM880.so
/usr/lib64/gconv/IBM891.so
/usr/lib64/gconv/IBM901.so
/usr/lib64/gconv/IBM902.so
/usr/lib64/gconv/IBM903.so
/usr/lib64/gconv/IBM9030.so
/usr/lib64/gconv/IBM904.so
/usr/lib64/gconv/IBM905.so
/usr/lib64/gconv/IBM9066.so
/usr/lib64/gconv/IBM918.so
/usr/lib64/gconv/IBM921.so
/usr/lib64/gconv/IBM922.so
/usr/lib64/gconv/IBM930.so
/usr/lib64/gconv/IBM932.so
/usr/lib64/gconv/IBM933.so
/usr/lib64/gconv/IBM935.so
/usr/lib64/gconv/IBM937.so
/usr/lib64/gconv/IBM939.so
/usr/lib64/gconv/IBM943.so
/usr/lib64/gconv/IBM9448.so
/usr/lib64/gconv/IEC_P27-1.so
/usr/lib64/gconv/INIS-8.so
/usr/lib64/gconv/INIS-CYRILLIC.so
/usr/lib64/gconv/INIS.so
/usr/lib64/gconv/ISIRI-3342.so
/usr/lib64/gconv/ISO-2022-CN-EXT.so
/usr/lib64/gconv/ISO-2022-CN.so
/usr/lib64/gconv/ISO-2022-JP-3.so
/usr/lib64/gconv/ISO-2022-JP.so
/usr/lib64/gconv/ISO-2022-KR.so
/usr/lib64/gconv/ISO-IR-197.so
/usr/lib64/gconv/ISO-IR-209.so
/usr/lib64/gconv/ISO646.so
/usr/lib64/gconv/ISO8859-1.so
/usr/lib64/gconv/ISO8859-10.so
/usr/lib64/gconv/ISO8859-11.so
/usr/lib64/gconv/ISO8859-13.so
/usr/lib64/gconv/ISO8859-14.so
/usr/lib64/gconv/ISO8859-15.so
/usr/lib64/gconv/ISO8859-16.so
/usr/lib64/gconv/ISO8859-2.so
/usr/lib64/gconv/ISO8859-3.so
/usr/lib64/gconv/ISO8859-4.so
/usr/lib64/gconv/ISO8859-5.so
/usr/lib64/gconv/ISO8859-6.so
/usr/lib64/gconv/ISO8859-7.so
/usr/lib64/gconv/ISO8859-8.so
/usr/lib64/gconv/ISO8859-9.so
/usr/lib64/gconv/ISO8859-9E.so
/usr/lib64/gconv/ISO_10367-BOX.so
/usr/lib64/gconv/ISO_11548-1.so
/usr/lib64/gconv/ISO_2033.so
/usr/lib64/gconv/ISO_5427-EXT.so
/usr/lib64/gconv/ISO_5427.so
/usr/lib64/gconv/ISO_5428.so
/usr/lib64/gconv/ISO_6937-2.so
/usr/lib64/gconv/ISO_6937.so
/usr/lib64/gconv/JOHAB.so
/usr/lib64/gconv/KOI-8.so
/usr/lib64/gconv/KOI8-R.so
/usr/lib64/gconv/KOI8-RU.so
/usr/lib64/gconv/KOI8-T.so
/usr/lib64/gconv/KOI8-U.so
/usr/lib64/gconv/LATIN-GREEK-1.so
/usr/lib64/gconv/LATIN-GREEK.so
/usr/lib64/gconv/MAC-CENTRALEUROPE.so
/usr/lib64/gconv/MAC-IS.so
/usr/lib64/gconv/MAC-SAMI.so
/usr/lib64/gconv/MAC-UK.so
/usr/lib64/gconv/MACINTOSH.so
/usr/lib64/gconv/MIK.so
/usr/lib64/gconv/NATS-DANO.so
/usr/lib64/gconv/NATS-SEFI.so
/usr/lib64/gconv/PT154.so
/usr/lib64/gconv/RK1048.so
/usr/lib64/gconv/SAMI-WS2.so
/usr/lib64/gconv/SHIFT_JISX0213.so
/usr/lib64/gconv/SJIS.so
/usr/lib64/gconv/T.61.so
/usr/lib64/gconv/TCVN5712-1.so
/usr/lib64/gconv/TIS-620.so
/usr/lib64/gconv/TSCII.so
/usr/lib64/gconv/UHC.so
/usr/lib64/gconv/UNICODE.so
/usr/lib64/gconv/UTF-16.so
/usr/lib64/gconv/UTF-32.so
/usr/lib64/gconv/UTF-7.so
/usr/lib64/gconv/VISCII.so
/usr/lib64/gconv/gconv-modules
/usr/lib64/gconv/gconv-modules.cache
/usr/lib64/gconv/libCNS.so
/usr/lib64/gconv/libGB.so
/usr/lib64/gconv/libISOIR165.so
/usr/lib64/gconv/libJIS.so
/usr/lib64/gconv/libJISX0213.so
/usr/lib64/gconv/libKSC.so
/usr/libexec/getconf
/usr/libexec/getconf/POSIX_V6_LP64_OFF64
/usr/libexec/getconf/POSIX_V7_LP64_OFF64
/usr/sbin/glibc_post_upgrade.x86_64
/usr/sbin/iconvconfig
/usr/sbin/iconvconfig.x86_64
/usr/share/doc/glibc-2.12
/usr/share/doc/glibc-2.12/BUGS
/usr/share/doc/glibc-2.12/CONFORMANCE
/usr/share/doc/glibc-2.12/COPYING
/usr/share/doc/glibc-2.12/COPYING.LIB
/usr/share/doc/glibc-2.12/FAQ
/usr/share/doc/glibc-2.12/INSTALL
/usr/share/doc/glibc-2.12/LICENSES
/usr/share/doc/glibc-2.12/NEWS
/usr/share/doc/glibc-2.12/NOTES
/usr/share/doc/glibc-2.12/PROJECTS
/usr/share/doc/glibc-2.12/README
/usr/share/doc/glibc-2.12/README.hesiod
/usr/share/doc/glibc-2.12/README.libm
/var/cache/ldconfig
/var/cache/ldconfig/aux-cache

authconfig

 # rpm -qil authconfig

Name        : authconfig                   Relocations: (not relocatable)
Version     : 6.1.4                             Vendor: CentOS
Release     : 6.el6                         Build Date: Thu 11 Nov 2010 01:40:47 AM CET
Install Date: Sun 16 Oct 2011 02:58:06 PM CEST      Build Host: c5b2.bsys.dev.centos.org
Group       : System Environment/Base       Source RPM: authconfig-6.1.4-6.el6.src.rpm
Size        : 1816496                          License: GPLv2+
Signature   : RSA/8, Sun 03 Jul 2011 06:03:13 AM CEST, Key ID 0946fca2c105b9de
Packager    : CentOS BuildSystem <http://bugs.centos.org>
URL         : https://fedorahosted.org/authconfig
Summary     : Command line tool for setting up authentication from network services
Description :
Authconfig is a command line utility which can configure a workstation
to use shadow (more secure) passwords.  Authconfig can also configure a
system to be a client for certain networked user information and
authentication schemes.
/etc/pam.d/fingerprint-auth-ac
/etc/pam.d/password-auth-ac
/etc/pam.d/smartcard-auth-ac
/etc/pam.d/system-auth-ac
/etc/sysconfig/authconfig
/usr/lib64/python2.6/site-packages/acutilmodule.so
/usr/sbin/authconfig
/usr/sbin/authconfig-tui
/usr/sbin/cacertdir_rehash
/usr/share/authconfig
/usr/share/authconfig/authconfig-tui.py
/usr/share/authconfig/authconfig-tui.pyc
/usr/share/authconfig/authconfig-tui.pyo
/usr/share/authconfig/authconfig.py
/usr/share/authconfig/authconfig.pyc
/usr/share/authconfig/authconfig.pyo
/usr/share/authconfig/authinfo.py
/usr/share/authconfig/authinfo.pyc
/usr/share/authconfig/authinfo.pyo
/usr/share/authconfig/dnsclient.py
/usr/share/authconfig/dnsclient.pyc
/usr/share/authconfig/dnsclient.pyo
/usr/share/authconfig/msgarea.py
/usr/share/authconfig/msgarea.pyc
/usr/share/authconfig/msgarea.pyo
/usr/share/authconfig/shvfile.py
/usr/share/authconfig/shvfile.pyc
/usr/share/authconfig/shvfile.pyo
/usr/share/doc/authconfig-6.1.4
/usr/share/doc/authconfig-6.1.4/COPYING
/usr/share/doc/authconfig-6.1.4/NOTES
/usr/share/doc/authconfig-6.1.4/README.samba3
/usr/share/doc/authconfig-6.1.4/TODO
/usr/share/locale/ar/LC_MESSAGES/authconfig.mo
/usr/share/locale/as/LC_MESSAGES/authconfig.mo
/usr/share/locale/bal/LC_MESSAGES/authconfig.mo
/usr/share/locale/bg/LC_MESSAGES/authconfig.mo
/usr/share/locale/bn/LC_MESSAGES/authconfig.mo
/usr/share/locale/bn_IN/LC_MESSAGES/authconfig.mo
/usr/share/locale/bs/LC_MESSAGES/authconfig.mo
/usr/share/locale/ca/LC_MESSAGES/authconfig.mo
/usr/share/locale/cs/LC_MESSAGES/authconfig.mo
/usr/share/locale/cy/LC_MESSAGES/authconfig.mo
/usr/share/locale/da/LC_MESSAGES/authconfig.mo
/usr/share/locale/de/LC_MESSAGES/authconfig.mo
/usr/share/locale/el/LC_MESSAGES/authconfig.mo
/usr/share/locale/en_GB/LC_MESSAGES/authconfig.mo
/usr/share/locale/es/LC_MESSAGES/authconfig.mo
/usr/share/locale/et/LC_MESSAGES/authconfig.mo
/usr/share/locale/fa/LC_MESSAGES/authconfig.mo
/usr/share/locale/fi/LC_MESSAGES/authconfig.mo
/usr/share/locale/fr/LC_MESSAGES/authconfig.mo
/usr/share/locale/gl/LC_MESSAGES/authconfig.mo
/usr/share/locale/gu/LC_MESSAGES/authconfig.mo
/usr/share/locale/he/LC_MESSAGES/authconfig.mo
/usr/share/locale/hi/LC_MESSAGES/authconfig.mo
/usr/share/locale/hr/LC_MESSAGES/authconfig.mo
/usr/share/locale/hu/LC_MESSAGES/authconfig.mo
/usr/share/locale/hy/LC_MESSAGES/authconfig.mo
/usr/share/locale/id/LC_MESSAGES/authconfig.mo
/usr/share/locale/is/LC_MESSAGES/authconfig.mo
/usr/share/locale/it/LC_MESSAGES/authconfig.mo
/usr/share/locale/ja/LC_MESSAGES/authconfig.mo
/usr/share/locale/ka/LC_MESSAGES/authconfig.mo
/usr/share/locale/kn/LC_MESSAGES/authconfig.mo
/usr/share/locale/ko/LC_MESSAGES/authconfig.mo
/usr/share/locale/ku/LC_MESSAGES/authconfig.mo
/usr/share/locale/lo/LC_MESSAGES/authconfig.mo
/usr/share/locale/lv/LC_MESSAGES/authconfig.mo
/usr/share/locale/mai/LC_MESSAGES/authconfig.mo
/usr/share/locale/mk/LC_MESSAGES/authconfig.mo
/usr/share/locale/ml/LC_MESSAGES/authconfig.mo
/usr/share/locale/mr/LC_MESSAGES/authconfig.mo
/usr/share/locale/ms/LC_MESSAGES/authconfig.mo
/usr/share/locale/my/LC_MESSAGES/authconfig.mo
/usr/share/locale/nb/LC_MESSAGES/authconfig.mo
/usr/share/locale/nl/LC_MESSAGES/authconfig.mo
/usr/share/locale/nn/LC_MESSAGES/authconfig.mo
/usr/share/locale/or/LC_MESSAGES/authconfig.mo
/usr/share/locale/pa/LC_MESSAGES/authconfig.mo
/usr/share/locale/pl/LC_MESSAGES/authconfig.mo
/usr/share/locale/pt/LC_MESSAGES/authconfig.mo
/usr/share/locale/pt_BR/LC_MESSAGES/authconfig.mo
/usr/share/locale/ro/LC_MESSAGES/authconfig.mo
/usr/share/locale/ru/LC_MESSAGES/authconfig.mo
/usr/share/locale/si/LC_MESSAGES/authconfig.mo
/usr/share/locale/sk/LC_MESSAGES/authconfig.mo
/usr/share/locale/sl/LC_MESSAGES/authconfig.mo
/usr/share/locale/sq/LC_MESSAGES/authconfig.mo
/usr/share/locale/sr/LC_MESSAGES/authconfig.mo
/usr/share/locale/sr@latin/LC_MESSAGES/authconfig.mo
/usr/share/locale/sv/LC_MESSAGES/authconfig.mo
/usr/share/locale/ta/LC_MESSAGES/authconfig.mo
/usr/share/locale/te/LC_MESSAGES/authconfig.mo
/usr/share/locale/tg/LC_MESSAGES/authconfig.mo
/usr/share/locale/tr/LC_MESSAGES/authconfig.mo
/usr/share/locale/uk/LC_MESSAGES/authconfig.mo
/usr/share/locale/ur/LC_MESSAGES/authconfig.mo
/usr/share/locale/vi/LC_MESSAGES/authconfig.mo
/usr/share/locale/wa/LC_MESSAGES/authconfig.mo
/usr/share/locale/zh_CN/LC_MESSAGES/authconfig.mo
/usr/share/locale/zh_TW/LC_MESSAGES/authconfig.mo
/usr/share/man/man5/fingerprint-auth-ac.5.gz
/usr/share/man/man5/password-auth-ac.5.gz
/usr/share/man/man5/smartcard-auth-ac.5.gz
/usr/share/man/man5/system-auth-ac.5.gz
/usr/share/man/man8/authconfig-tui.8.gz
/usr/share/man/man8/authconfig.8.gz
/usr/share/man/man8/cacertdir_rehash.8.gz
/var/lib/authconfig

Konfiguration

Die Konfiguration unseres Clients nehmen wir am einfachsten mit Hilfe des Programmes authconfig aus dem RPM-Paket authconfig-gtk vor. Hierzu rufen wir authconfig mit den nötigen Optionen für unsere (Test-)Umgebung auf.

disablemd5 MD5 Passworter abschalten
passalgo Definition des Passworthash-Algoritmuses
enablemkhomedir Homedirectory beim ersten Login eines neuen Users automatisch anlegen
enableldap LDAP User Informationen aktivieren
enableldapauth LDAP Authentifizierung aktivieren
ldapserver LDAP Servername oder URI Definition
ldapbasedn LDAP Basde DN Definition
update Update der Konfigurationsdateien mit den gesetzten Werten.

Eine ausführliche Beschreibung der optionen erhält man übder die Manpage von authconfig oder beim Aufruf der Option –help.

 # authconfig --help

Wir Konfigurieren nun also unsere LDAP-Client-Authentifizierung wie folgt.

 # authconfig --disablemd5 --passalgo=sha256 --enablemkhomedir --enableldap --enableldapauth --ldapserver=ldap.dmz.nausch.org --ldapbasedn="dc=nausch,dc=org" --update

 nslcd starten:                                             [  OK  ]
 oddjobd starten:                                           [  OK  ]

Die einzelnen Konfigurationsdateien, die mit dem vorgenannten Programmaufruf angepasst wurden, werden wir uns im Detail betrachten, ggf. anpassen und mit Bearbeitungsvermerken versehen, damit wir später noch nachvollziehen können, welche Änderungen im Detail notwendig waren um die LDAP Client Authentifizierung aktiviert werden konnte.

Zur Dokumentation und ggf. spätere weitere Dokumentationsschritte versehen wir optional alle Änderungen mit einem Kommntar, ala: # Django : Datum [optionaler Grund].

authconfig

In der Konfigurationsdatei /etc/sysconfig/authconfig setzen wir die beiden folgenden Werte von no auf yes:

USELDAP=yes (LDAP-Authentifizierung aktivieren.)
FORCELEGACY=yes (CentOS 6 nutzt standardmäßig TLS für die LDAP-Authentifizierung. Mit diesem Schalter wird diese Voreinstellung deaktiviert und die die unverschlüsselte Kommunikation mit dem LDAP-Server erzwungen.)

Zur Bearbeitung der Konfigurationsdatei nutzen wir wie so oft immer unseren Editor der Wahl vim.

 # vim /etc/sysconfig/authconfig

/etc/sysconfig/authconfig

USEMKHOMEDIR=no
USEPAMACCESS=no
CACHECREDENTIALS=yes
USESSSDAUTH=no
USESHADOW=yes
USEWINBIND=no
USEDB=no
FORCELEGACY=yes
USEFPRINTD=yes
FORCESMARTCARD=no
PASSWDALGORITHM=sha512
USELDAPAUTH=no
USEPASSWDQC=no
USELOCAUTHORIZE=yes
USECRACKLIB=yes
USEWINBINDAUTH=no
USESMARTCARD=no
USELDAP=yes
USENIS=no
USEKERBEROS=no
USESYSNETAUTH=no
USESMBAUTH=no
USESSSD=no
USEHESIOD=no

ldap.conf

In der Konfigurationsdatei /etc/openldap/ldap.conf tragen wir folgende Daten nach:

BASE dc=nausch, dc=org
URI ldap://ldap.dmz.nausch.org
TLS_CACERTDIR /etc/openldap/cacerts

Zur Bearbeitung der Konfigurationsdatei nutzen wir wie so oft immer unseren Editor der Wahl vim.

 # vim /etc/openldap/ldap.conf

/etc/openldap/ldap.conf

#
# LDAP Defaults
#
 
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
 
#BASE   dc=example, dc=com
#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666
 
#SIZELIMIT      12
#TIMELIMIT      15
#DEREF          never
 
# Django : 2011-10-28 LDAP Client Authentication
BASE    dc=nausch, dc=org
URI     ldap://ldap.dmz.nausch.org
TLS_CACERTDIR /etc/openldap/cacerts

pam_ldap.conf

In der Konfigurationsdatei /etc/pam_ldap.conf tragen wir folgende Daten nach:

base dc=nausch,dc=org
uri ldap://ldap.dmz.nausch.org
ssl no
tls_cacertdir /etc/openldap/cacerts
pam_password sha512

Zur Bearbeitung der Konfigurationsdatei nutzen wir wie so oft immer unseren Editor der Wahl vim.

 # vim /etc/pam_ldap.conf

/etc/pam_ldap.conf

# @(#)$Id: ldap.conf,v 1.38 2006/05/15 08:13:31 lukeh Exp $
#
# This is the configuration file for the LDAP nameservice
# switch library and the LDAP PAM module.
#
# The man page for this file is pam_ldap(5)
#
# PADL Software
# http://www.padl.com
#
 
# Your LDAP server. Must be resolvable without using LDAP.
# Multiple hosts may be specified, each separated by a 
# space. How long nss_ldap takes to failover depends on
# whether your LDAP client library supports configurable
# network or connect timeouts (see bind_timelimit).
 
# Django : 2011-10-28 LDAP Client-Authentication
# default : host 127.0.0.1
 
# The distinguished name of the search base.
# Django : 2011-10-28 LDAP Client-Authentication
# base dc=example,dc=com
base dc=nausch,dc=org
 
# Another way to specify your LDAP server is to provide an
# uri with the server name. This allows to use
# Unix Domain Sockets to connect to a local LDAP Server.
#uri ldap://127.0.0.1/
#uri ldaps://127.0.0.1/   
#uri ldapi://%2fvar%2frun%2fldapi_sock/
# Note: %2f encodes the '/' used as directory separator
 
# The LDAP version to use (defaults to 3
# if supported by client library)
#ldap_version 3
 
# The distinguished name to bind to the server with.
# Optional: default is to bind anonymously.
#binddn cn=proxyuser,dc=example,dc=com
 
# The credentials to bind with. 
# Optional: default is no credential.
#bindpw secret
 
# The distinguished name to bind to the server with
# if the effective user ID is root. Password is
# stored in /etc/ldap.secret (mode 600)
#rootbinddn cn=manager,dc=example,dc=com
 
# The port.
# Optional: default is 389.
#port 389
 
# The search scope.
#scope sub
#scope one
#scope base
 
# Search timelimit
#timelimit 30
 
# Bind/connect timelimit
#bind_timelimit 30
 
# Reconnect policy: hard (default) will retry connecting to
# the software with exponential backoff, soft will fail
# immediately.
#bind_policy hard
 
# Idle timelimit; client will close connections
# (nss_ldap only) if the server has not been contacted
# for the number of seconds specified below.
#idle_timelimit 3600
 
# Filter to AND with uid=%s
#pam_filter objectclass=account
 
# The user ID attribute (defaults to uid)
#pam_login_attribute uid
 
# Search the root DSE for the password policy (works
# with Netscape Directory Server)
#pam_lookup_policy yes
 
# Check the 'host' attribute for access control
# Default is no; if set to yes, and user has no
# value for the host attribute, and pam_ldap is
# configured for account management (authorization)
# then the user will not be allowed to login.
#pam_check_host_attr yes
 
# Check the 'authorizedService' attribute for access
# control
# Default is no; if set to yes, and the user has no
# value for the authorizedService attribute, and
# pam_ldap is configured for account management
# (authorization) then the user will not be allowed
# to login.
#pam_check_service_attr yes
 
# Group to enforce membership of
#pam_groupdn cn=PAM,ou=Groups,dc=example,dc=com
 
# Group member attribute
#pam_member_attribute uniquemember
 
# Specify a minium or maximum UID number allowed
#pam_min_uid 0
#pam_max_uid 0
 
# Template login attribute, default template user
# (can be overriden by value of former attribute
# in user's entry)
#pam_login_attribute userPrincipalName
#pam_template_login_attribute uid
#pam_template_login nobody
 
# HEADS UP: the pam_crypt, pam_nds_passwd,
# and pam_ad_passwd options are no
# longer supported.
#
# Do not hash the password at all; presume
# the directory server will do it, if
# necessary. This is the default.
#pam_password clear
 
# Hash password locally; required for University of
# Michigan LDAP server, and works with Netscape
# Directory Server if you're using the UNIX-Crypt
# hash mechanism and not using the NT Synchronization
# service. 
#pam_password crypt
 
# Remove old password first, then update in
# cleartext. Necessary for use with Novell
# Directory Services (NDS)
#pam_password clear_remove_old
#pam_password nds
 
# RACF is an alias for the above. For use with
# IBM RACF
#pam_password racf
 
# Update Active Directory password, by
# creating Unicode password and updating
# unicodePwd attribute.
#pam_password ad
 
# Use the OpenLDAP password change
# extended operation to update the password.
#pam_password exop
 
# Redirect users to a URL or somesuch on password
# changes.
#pam_password_prohibit_message Please visit http://internal to change your password.
 
# RFC2307bis naming contexts
# Syntax:
# nss_base_XXX          base?scope?filter
# where scope is {base,one,sub}
# and filter is a filter to be &'d with the
# default filter.
# You can omit the suffix eg:
# nss_base_passwd       ou=People,
# to append the default base DN but this
# may incur a small performance impact.
#nss_base_passwd        ou=People,dc=example,dc=com?one
#nss_base_shadow        ou=People,dc=example,dc=com?one
#nss_base_group         ou=Group,dc=example,dc=com?one
#nss_base_hosts         ou=Hosts,dc=example,dc=com?one
#nss_base_services      ou=Services,dc=example,dc=com?one
#nss_base_networks      ou=Networks,dc=example,dc=com?one
#nss_base_protocols     ou=Protocols,dc=example,dc=com?one
#nss_base_rpc           ou=Rpc,dc=example,dc=com?one
#nss_base_ethers        ou=Ethers,dc=example,dc=com?one
#nss_base_netmasks      ou=Networks,dc=example,dc=com?ne
#nss_base_bootparams    ou=Ethers,dc=example,dc=com?one
#nss_base_aliases       ou=Aliases,dc=example,dc=com?one
#nss_base_netgroup      ou=Netgroup,dc=example,dc=com?one
 
# attribute/objectclass mapping
# Syntax:
#nss_map_attribute      rfc2307attribute        mapped_attribute
#nss_map_objectclass    rfc2307objectclass      mapped_objectclass
 
# configure --enable-nds is no longer supported.
# NDS mappings
#nss_map_attribute uniqueMember member
 
# Services for UNIX 3.5 mappings
#nss_map_objectclass posixAccount User
#nss_map_objectclass shadowAccount User
#nss_map_attribute uid msSFU30Name
#nss_map_attribute uniqueMember msSFU30PosixMember
#nss_map_attribute userPassword msSFU30Password
#nss_map_attribute homeDirectory msSFU30HomeDirectory
#nss_map_attribute homeDirectory msSFUHomeDirectory
#nss_map_objectclass posixGroup Group
#pam_login_attribute msSFU30Name
#pam_filter objectclass=User
#pam_password ad
 
# configure --enable-mssfu-schema is no longer supported.
# Services for UNIX 2.0 mappings
#nss_map_objectclass posixAccount User
#nss_map_objectclass shadowAccount user
#nss_map_attribute uid msSFUName
#nss_map_attribute uniqueMember posixMember
#nss_map_attribute userPassword msSFUPassword
#nss_map_attribute homeDirectory msSFUHomeDirectory
#nss_map_attribute shadowLastChange pwdLastSet
#nss_map_objectclass posixGroup Group
#nss_map_attribute cn msSFUName
#pam_login_attribute msSFUName
#pam_filter objectclass=User
#pam_password ad
 
# RFC 2307 (AD) mappings
#nss_map_objectclass posixAccount user
#nss_map_objectclass shadowAccount user
#nss_map_attribute uid sAMAccountName
#nss_map_attribute homeDirectory unixHomeDirectory
#nss_map_attribute shadowLastChange pwdLastSet
#nss_map_objectclass posixGroup group
#nss_map_attribute uniqueMember member
#pam_login_attribute sAMAccountName
#pam_filter objectclass=User
#pam_password ad
 
# configure --enable-authpassword is no longer supported
# AuthPassword mappings
#nss_map_attribute userPassword authPassword
 
# AIX SecureWay mappings
#nss_map_objectclass posixAccount aixAccount
#nss_base_passwd ou=aixaccount,?one
#nss_map_attribute uid userName
#nss_map_attribute gidNumber gid
#nss_map_attribute uidNumber uid
#nss_map_attribute userPassword passwordChar
#nss_map_objectclass posixGroup aixAccessGroup
#nss_base_group ou=aixgroup,?one
#nss_map_attribute cn groupName
#nss_map_attribute uniqueMember member
#pam_login_attribute userName
#pam_filter objectclass=aixAccount
#pam_password clear
 
# Netscape SDK LDAPS
#ssl on
 
# Netscape SDK SSL options
#sslpath /etc/ssl/certs
 
# OpenLDAP SSL mechanism
# start_tls mechanism uses the normal LDAP port, LDAPS typically 636
#ssl start_tls
#ssl on
 
# OpenLDAP SSL options
# Require and verify server certificate (yes/no)
# Default is to use libldap's default behavior, which can be configured in
# /etc/openldap/ldap.conf using the TLS_REQCERT setting.  The default for
# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".
#tls_checkpeer yes
 
# CA certificates for server certificate verification
# At least one of these are required if tls_checkpeer is "yes"
#tls_cacertfile /etc/ssl/ca.cert
#tls_cacertdir /etc/ssl/certs
 
# Seed the PRNG if /dev/urandom is not provided
#tls_randfile /var/run/egd-pool
 
# SSL cipher suite
# See man ciphers for syntax
#tls_ciphers TLSv1
 
# Client certificate and key
# Use these, if your server requires client authentication.
#tls_cert
#tls_key
 
# Disable SASL security layers. This is needed for AD.
#sasl_secprops maxssf=0
 
# Override the default Kerberos ticket cache location.
#krb5_ccname FILE:/etc/.ldapcache
 
# SASL mechanism for PAM authentication - use is experimental
# at present and does not support password policy control
#pam_sasl_mech DIGEST-MD5
 
# Django : 2011-10-28 LDAP Client-Authentication, automatisch eingetragen mit Hilfe von authconfig
uri ldap://ldap.dmz.nausch.org
ssl no
tls_cacertdir /etc/openldap/cacerts
pam_password sha256

nslcd.conf

In der Konfigurationsdatei /etc/nslcd.conf tragen wir folgende Daten nach:

uri ldap://ldap.dmz.nausch.org
base dc=nausch,dc=org
ssl no

Zur Bearbeitung der Konfigurationsdatei nutzen wir wie so oft immer unseren Editor der Wahl vim.

 # vim /etc/nslcd.conf

/etc/nslcd.conf

# This is the configuration file for the LDAP nameservice
# switch library's nslcd daemon. It configures the mapping
# between NSS names (see /etc/nsswitch.conf) and LDAP
# information in the directory.
# See the manual page nslcd.conf(5) for more information.
 
# The uri pointing to the LDAP server to use for name lookups.
# Multiple entries may be specified. The address that is used
# here should be resolvable without using LDAP (obviously).
#uri ldap://127.0.0.1/
#uri ldaps://127.0.0.1/
#uri ldapi://%2fvar%2frun%2fldapi_sock/
# Note: %2f encodes the '/' used as directory separator
# uri ldap://127.0.0.1/
 
# The LDAP version to use (defaults to 3
# if supported by client library)
#ldap_version 3
 
# The distinguished name of the search base.
# base dc=example,dc=com
 
# The distinguished name to bind to the server with.
# Optional: default is to bind anonymously.
#binddn cn=proxyuser,dc=example,dc=com
 
# The credentials to bind with.
# Optional: default is no credentials.
# Note that if you set a bindpw you should check the permissions of this file.
#bindpw secret
 
# The distinguished name to perform password modifications by root by.
#rootpwmoddn cn=admin,dc=example,dc=com
 
# The default search scope.
#scope sub
#scope one
#scope base
 
# Customize certain database lookups.
#base   group  ou=Groups,dc=example,dc=com
#base   passwd ou=People,dc=example,dc=com
#base   shadow ou=People,dc=example,dc=com
#scope  group  onelevel
#scope  hosts  sub
 
# Bind/connect timelimit.
#bind_timelimit 30
 
# Search timelimit.
#timelimit 30
 
# Idle timelimit. nslcd will close connections if the
# server has not been contacted for the number of seconds.
#idle_timelimit 3600
 
# Use StartTLS without verifying the server certificate.
#ssl start_tls
#tls_reqcert never
 
# CA certificates for server certificate verification
#tls_cacertdir /etc/ssl/certs
#tls_cacertfile /etc/ssl/ca.cert
 
# Seed the PRNG if /dev/urandom is not provided
#tls_randfile /var/run/egd-pool
 
# SSL cipher suite
# See man ciphers for syntax
#tls_ciphers TLSv1
 
# Client certificate and key
# Use these, if your server requires client authentication.
#tls_cert
#tls_key
 
# NDS mappings
#map group uniqueMember member
 
# Mappings for Services for UNIX 3.5
#filter passwd (objectClass=User)
#map    passwd uid              msSFU30Name
#map    passwd userPassword     msSFU30Password
#map    passwd homeDirectory    msSFU30HomeDirectory
#map    passwd homeDirectory    msSFUHomeDirectory
#filter shadow (objectClass=User)
#map    shadow uid              msSFU30Name
#map    shadow userPassword     msSFU30Password
#filter group  (objectClass=Group)
#map    group  uniqueMember     msSFU30PosixMember
 
# Mappings for Services for UNIX 2.0
#filter passwd (objectClass=User)
#map    passwd uid              msSFUName
#map    passwd userPassword     msSFUPassword
#map    passwd homeDirectory    msSFUHomeDirectory
#map    passwd gecos            msSFUName
#filter shadow (objectClass=User)
#map    shadow uid              msSFUName
#map    shadow userPassword     msSFUPassword
#map    shadow shadowLastChange pwdLastSet
#filter group  (objectClass=Group)
#map    group  uniqueMember     posixMember
 
# Mappings for Active Directory
#pagesize 1000
#referrals off
#filter passwd (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
#map    passwd uid              sAMAccountName
#map    passwd homeDirectory    unixHomeDirectory
#map    passwd gecos            displayName
#filter shadow (&(objectClass=user)(!(objectClass=computer))(uidNumber=*)(unixHomeDirectory=*))
#map    shadow uid              sAMAccountName
#map    shadow shadowLastChange pwdLastSet
#filter group  (objectClass=group)
#map    group  uniqueMember     member
 
# Mappings for AIX SecureWay
#filter passwd (objectClass=aixAccount)
#map    passwd uid              userName
#map    passwd userPassword     passwordChar
#map    passwd uidNumber        uid
#map    passwd gidNumber        gid
#filter group  (objectClass=aixAccessGroup)
#map    group  cn               groupName
#map    group  uniqueMember     member
#map    group  gidNumber        gid
uid nslcd
gid ldap
# This comment prevents repeated auto-migration of settings.
# Django : 2011-10-28 LDAP Client Authentication, angefügt durch den Aufruf von authconfig
uri ldap://ldap.dmz.nausch.org/
base dc=nausch,dc=org
ssl no
tls_cacertdir /etc/openldap/cacerts

nsswitch.conf

In der Konfigurationsdatei /etc/pam.d/system-auth tragen wir folgende Daten nach:

passwd: files ldap
shadow: files ldap
group: files ldap

netgroup: ldap

automount: files ldap

Zur Bearbeitung der Konfigurationsdatei nutzen wir wie so oft immer unseren Editor der Wahl vim.

 # vim /etc/nsswitch.conf

/etc/nsswitch.conf

#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Valid entries include:
#
#       nisplus                 Use NIS+ (NIS version 3)
#       nis                     Use NIS (NIS version 2), also called YP
#       dns                     Use DNS (Domain Name Service)
#       files                   Use the local files
#       db                      Use the local database (.db) files
#       compat                  Use NIS on compat mode
#       hesiod                  Use Hesiod for user lookups
#       [NOTFOUND=return]       Stop searching if not found so far
#
 
# To use db, put the "db" in front of "files" for entries you want to be
# looked up first in the databases
#
# Example:
#passwd:    db files nisplus nis
#shadow:    db files nisplus nis
#group:     db files nisplus nis
 
# Django : 2011-10-28 LDAP Client Authentication
# default
# passwd:     files
# shadow:     files
# group:      files
passwd:     files ldap
shadow:     files ldap
group:      files ldap
 
#hosts:     db files nisplus nis dns
hosts:      files dns
 
# Example - obey only what nisplus tells us...
#services:   nisplus [NOTFOUND=return] files
#networks:   nisplus [NOTFOUND=return] files
#protocols:  nisplus [NOTFOUND=return] files
#rpc:        nisplus [NOTFOUND=return] files
#ethers:     nisplus [NOTFOUND=return] files
#netmasks:   nisplus [NOTFOUND=return] files     
 
bootparams: nisplus [NOTFOUND=return] files
 
ethers:     files
netmasks:   files
networks:   files
protocols:  files
rpc:        files
services:   files
 
# Django : 2011-10-28 LDAP Client Authentication
# default
# netgroup:   nisplus
netgroup:   ldap
 
publickey:  nisplus
 
# Django : 2011-10-28 LDAP Client Authentication
# default
# automount:  files nisplus
automount:  files ldap
aliases:    files nisplus

system-auth

Durch den Aufruf des Programmes authconfig wurden die folgenden pam.d-Konfigurationsdateien angepasst:

/etc/pam.d/fingerprint-auth
/etc/pam.d/password-auth
/etc/pam.d/smartcard-auth
/etc/pam.d/smtp
/etc/pam.d/system-auth

Zur Bearbeitung der Konfigurationsdatei nutzen wir wie so oft immer unseren Editor der Wahl vim.

 # vim /etc/pam.d/fingerprint-auth

/etc/pam.d/fingerprint-auth

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_fprintd.so
auth        required      pam_deny.so
 
account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so
 
password    required      pam_deny.so
 
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_oddjob_mkhomedir.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so

 # vim /etc/pam.d/password-auth

/etc/pam.d/password-auth

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so
 
account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so
 
password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha256 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so
 
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_oddjob_mkhomedir.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so

 # vim /etc/pam.d/smartcard-auth

/etc/pam.d/smartcard-auth

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        [success=done ignore=ignore default=die] pam_pkcs11.so wait_for_card card_only
auth        required      pam_deny.so
 
account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so
 
password    required      pam_pkcs11.so
 
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_oddjob_mkhomedir.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so

 # vim /etc/pam.d/smtp

/etc/pam.d/smtp

#%PAM-1.0
auth       include      password-auth
account    include      password-auth

 # vim /etc/pam.d/system-auth

/etc/pam.d/system-auth

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.
auth        required      pam_env.so
auth        sufficient    pam_fprintd.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so
 
account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so
 
password    requisite     pam_cracklib.so try_first_pass retry=3 type=
password    sufficient    pam_unix.so sha256 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so
 
session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_oddjob_mkhomedir.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so

automatischer Systemstart des nslc-Dämon

Damit nun beim nächsten Start des Systems der notwendige naming services LDAP client daemon kurz nslcd mit gestartet wird, versetzen wir das Startscript in den Modus „on“.

 # chkconfig nslcd on

Den Status überprüfen wir bei Bedarf mittels:

 # chkconfig --list | grep nslcd

 nslcd           0:off   1:off   2:on    3:on    4:on    5:on    6:off

Zum Abschluss unserer Konfiguration starten wir nun unseren CentOS 6 Client einmal durch.

 # reboot

Test

LDAP Abfrage

Zur Abfrage eines LDAP-Users können wir folgenden Aufruf verwenden:

 $ ldapsearch -x -LLL -H ldap://ldap.dmz.nausch.org -b "dc=nausch,dc=org" "uid=bigchief"

dn: uid=bigchief,ou=People,dc=nausch,dc=org
uid: bigchief
cn: BigChief
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
shadowLastChange: 15274
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 501
gidNumber: 501
homeDirectory: /home/bigchief
gecos: BigChief

LDAP-Abfrage mit dem User Django aber mit falschem Passwort:

 $ ldapsearch -x -LLL -H ldap://ldap.dmz.nausch.org -b "dc=nausch,dc=org" "uid=django" -W -D "uid=django,ou=People,dc=nausch,dc=org"

Enter LDAP Password: 
ldap_bind: Invalid credentials (49)

LDAP-Abfrage mit dem User Django aber mit richtigem Passwort:

 $ ldapsearch -x -LLL -H ldap://ldap.dmz.nausch.org -b "dc=nausch,dc=org" "uid=django" -W -D "uid=django,ou=People,dc=nausch,dc=org"

Enter LDAP Password: 
dn: uid=django,ou=People,dc=nausch,dc=org
uid: django
cn: Django
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword:: e2NyeXB0fSQ2JENna3VQVFplJDRiT2wvR2dSMUg4OWlxQjRtaU4yYVN5VndHUWE
 2SVlum31nScH3fFiSt31nV0lLd3pPzlxd2tFYWJQdTZUL1BITWNXcWFLbW9KUnd6NlhwVTd3Vm0x
shadowLastChange: 15272
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 500
gidNumber: 500
homeDirectory: /home/django
gecos: Django

Clienttest

Die erfolgreiche Konfiguration unseres Rechners überprüfen wir so:

Mit getent lassen wir uns die Informationen eines Users anzeigen, der sowohl in der /etc/shadow wie auch im zentralen LDAP-Verzeichnisdienst hinterlegt ist. Wenn alles gut gelaufen ist, werden uns zwei Einträge präsentiert.
```
$ getent passwd | grep django
django:x:500:500::/home/django:/bin/bash
django:x:500:500:Django:/home/django:/bin/bash
```
Als nächstes wählen wir einen Nutzer der nur im LDAP-Verzeichnisdienst einen Account hat, nicht aber auf der lokalen Maschine.
```
$ getent passwd | grep bigchief
bigchief:x:501:501:BigChief:/home/bigchief:/bin/bash 
```
Dann melden wir uns nun an unserem Client als ein Benutzer an, der lokal auf der Maschine nicht existiert, werden wir beim Login nach dem Passwort gefragt, welches gegen den zentralen OpenLDAP-Server verifiziert wird. Ist das Passwort richtig wird auch gleich das zugehörige Nutzer-Homeverzeichnis angelegt.
```
[django@vml010008 ~]$ su - ruben
```
```
Password:
```
```
Creating directory '/home/ruben'.
```

Inhaltsverzeichnis

Konfiguration auf Clientseite zur Client-Authentification via anonymous bind

Installation

openldap

openldap-clients

pam_ldap

nss-pam-ldapd

pam

glibc

authconfig

Konfiguration

authconfig

ldap.conf

pam_ldap.conf

nslcd.conf

nsswitch.conf

system-auth

automatischer Systemstart des nslc-Dämon

Test

LDAP Abfrage

Clienttest

Links